6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joanne Koong [ Upstream commit 6582f8a06698403dccf8a01b7eef176b2c6dd7ff ] Move header copying to ring logic into a new copy_header_to_ring() function. This makes the copy_to_user() logic more clear and centralizes error handling / rate-limited logging. Reviewed-by: Bernd Schubert Reviewed-by: Jeff Layton Reviewed-by: Baokun Li Signed-off-by: Joanne Koong Signed-off-by: Miklos Szeredi Stable-dep-of: fd10f40af314 ("fuse: copy request headers via a stack buffer for io-uring") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- fs/fuse/dev_uring.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) --- a/fs/fuse/dev_uring.c +++ b/fs/fuse/dev_uring.c @@ -581,6 +581,18 @@ err: return err; } +static __always_inline int copy_header_to_ring(void __user *ring, + const void *header, + size_t header_size) +{ + if (copy_to_user(ring, header, header_size)) { + pr_info_ratelimited("Copying header to ring failed.\n"); + return -EFAULT; + } + + return 0; +} + static int fuse_uring_copy_from_ring(struct fuse_ring *ring, struct fuse_req *req, struct fuse_ring_ent *ent) @@ -643,13 +655,11 @@ static int fuse_uring_args_to_ring(struc * Some op code have that as zero size. */ if (args->in_args[0].size > 0) { - err = copy_to_user(&ent->headers->op_in, in_args->value, - in_args->size); - if (err) { - pr_info_ratelimited( - "Copying the header failed.\n"); - return -EFAULT; - } + err = copy_header_to_ring(&ent->headers->op_in, + in_args->value, + in_args->size); + if (err) + return err; } in_args++; num_args--; @@ -665,9 +675,8 @@ static int fuse_uring_args_to_ring(struc } ent_in_out.payload_sz = cs.ring.copied_sz; - err = copy_to_user(&ent->headers->ring_ent_in_out, &ent_in_out, - sizeof(ent_in_out)); - return err ? -EFAULT : 0; + return copy_header_to_ring(&ent->headers->ring_ent_in_out, &ent_in_out, + sizeof(ent_in_out)); } static int fuse_uring_copy_to_ring(struct fuse_ring_ent *ent, @@ -696,14 +705,8 @@ static int fuse_uring_copy_to_ring(struc } /* copy fuse_in_header */ - err = copy_to_user(&ent->headers->in_out, &req->in.h, - sizeof(req->in.h)); - if (err) { - err = -EFAULT; - return err; - } - - return 0; + return copy_header_to_ring(&ent->headers->in_out, &req->in.h, + sizeof(req->in.h)); } static int fuse_uring_prepare_send(struct fuse_ring_ent *ent,